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WHAT IS CLAIMED IS: 

1 . A method for testing a design of a circuit, comprising: 
providing a model of the design; 

providing a first property for the design, wherein the first property describes a first 
behavior; 

checking the model using the first property and an environment of the design at a 
reset state until an example of the first behavior occurs; 

providing a second property for the design, wherein the second property describes a 
second behavior; and 

checking the model using the second property and an environment of the design at a 
state when the example of the first behavior occurs. 

2. The method of claim 1, wherein providing the first property comprises: 
providing a Boolean expression representing a formula that the first behavior does not 

occur, wherein the Boolean expression comprises a plurality of Boolean variables. 

3. The method of claim 2, wherein checking the model using the first property 
comprises: 

determining a set of values for the Boolean variables of the Boolean expression that 
causes the Boolean expression to be false. 

4. The method of claim 1, further comprising: 
providing the environment of the design at the reset state. 

5. The method of claim 1, further comprising: 

providing the environment of the design at a state when the example of the first 
behavior occurs. 
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6. The method of claim 5, wherein providing the environment of the design at 
the state when the example of the first behavior occurs comprises at least one of the group 
consisting of: 

describing the state when the example of the first behavior occurs; and 
providing the values of the Boolean variables of the Boolean expression. 

7. A computer program for testing a design of a circuit, comprising: 
providing a model of the design; 

providing a first property for the design, wherein the first property describes a first 
behavior; 

checking the model using the first property and an environment of the design at a 
reset state until an example of the first behavior occurs; 

providing a second property for the design, wherein the second property describes a 
second behavior; and 

checking the model using the second property and an environment of the design at a 
state when the example of the first behavior occurs. 

8. The computer program of claim 7, wherein providing the first property 
comprises: 

providing a Boolean expression representing a formula that the first behavior does not 
occur, wherein the Boolean expression comprises a plurality of Boolean variables. 

9. The computer program of claim 8, wherein checking the model using the first 
property comprises: 

determining a set of values for the Boolean variables of the Boolean expression that 
causes the Boolean expression to be false. 

10. The computer program of claim 7, further comprising: 
providing the environment of the design at the reset state. 

1 1 . The computer program of claim 7, further comprising: 
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providing the environment of the design at a state when the example of the first 
behavior occurs. 

12. The computer program of claim 1 1 , wherein providing the environment of the 
5 design at the state when the example of the first behavior occurs comprises at least one of the 
group consisting of: 

describing the state when the example of the first behavior occurs; and 
providing the values of the Boolean variables of the Boolean expression. 
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